ai-scanner

Scan your codebase for LLM SDK usage, AI frameworks, exposed API tokens, and hardcoded secrets.

Zero dependencies. 145 detection patterns. Works with Node.js 18+. Detects 23 LLM SDKs, 24 AI frameworks, 20+ AI token patterns, and 59 generic secret patterns across Python, JavaScript, TypeScript, Go, Java, and more.

Installation

# Run directly — no install needed
npx ai-scanner ./my-project

# Or install globally
npm install -g ai-scanner
ai-scanner ./my-project

Quick Start

Point ai-scanner at any directory to get instant results:

# Scan current directory (AI + generic secrets)
ai-scanner

# Scan a specific project
ai-scanner ./my-project

# Security-only: just find exposed tokens & secrets
ai-scanner --tokens-only

CLI Options

# Combine flags for CI pipelines
ai-scanner ./src --tokens-only --exit-code --json

# AI patterns only (no Stripe, GitHub tokens, etc.)
ai-scanner --ai-only

# Include .env files in the scan
ai-scanner --scan-env

Smart Filtering

ai-scanner is context-aware. It distinguishes between using an SDK in source code vs. mentioning it in documentation.

Detection Coverage

AI Tokens 20+

Generic Secrets 59 patterns

LLM SDKs 23

AI Frameworks 24

Severity Levels

MCP Server

Use ai-scanner as a tool for AI agents via the Model Context Protocol. Works with Claude Code, Claude Desktop, Cursor, and Windsurf.

Setup

# Claude Code — one command
claude mcp add ai-scanner npx ai-scanner-mcp

For Claude Desktop, Cursor, or Windsurf — add to your MCP config file:

{
  "mcpServers": {
    "ai-scanner": {
      "command": "npx",
      "args": ["ai-scanner-mcp"]
    }
  }
}

Tools

Once connected, ask your AI agent things like:

See ai-scanner-mcp for full documentation.

Examples

Scan a GitHub Repo

Clone any public repo and scan it in one command:

git clone --depth 1 https://github.com/user/repo /tmp/repo
npx ai-scanner /tmp/repo
rm -rf /tmp/repo

Or use the included helper scripts:

# Shell — clones, scans, cleans up automatically
./examples/scan-github-repo.sh https://github.com/langchain-ai/langchainjs

# Node.js — uses ai-scanner as a library, saves JSON report
node examples/scan-github-repo.js https://github.com/langchain-ai/langchainjs

Batch Scan Multiple Repos

# Edit the REPOS array in the script, then run:
node examples/scan-multiple-repos.js

# Output:
#   🚨 my-api          12 findings   3 critical  2 SDKs  1 frameworks
#   📦 my-app           8 findings   0 critical  3 SDKs  2 frameworks
#   ✅ my-lib           0 findings   0 critical  0 SDKs  0 frameworks

Use as a Library

const { Scanner } = require('ai-scanner');

const scanner = new Scanner({ rootDir: './my-project' });
const result = scanner.scan();

// Access structured results
console.log(result.stats.criticalFindings);
console.log(result.findings.filter(f => f.type === 'token'));

CI/CD Integration

GitHub Actions

# .github/workflows/ai-scan.yml
name: AI Security Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Scan for exposed tokens & secrets
        run: npx ai-scanner --tokens-only --exit-code

Pre-commit Hook

# .husky/pre-commit
npx ai-scanner --tokens-only --exit-code

About

Built by Aakash Bhardwaj.